Analysis

  • max time kernel
    127s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    25-06-2022 05:55

General

  • Target

    c58178687435a7997d8de3fcd8a76c1a4447beaabb4977882e4bc39ea27cc5a3.exe

  • Size

    2.7MB

  • MD5

    c37a90a51d440a83a7096423c8e04809

  • SHA1

    7094470281801383ed8991407359e339e58cf6f3

  • SHA256

    c58178687435a7997d8de3fcd8a76c1a4447beaabb4977882e4bc39ea27cc5a3

  • SHA512

    70a1b9181a3de343d541ecfc73b76f5e7229653a2c15e82d985e558786ce3a5bb9804dfcc34a96b11d3f49dadc015c005f9adc62fda0aec957e87dc1e75d21b2

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-t..ty-client.resources\1\Information.txt

Family

qulab

Ransom Note
# /===============================\ # |=== QULAB CLIPPER + STEALER ===| # |===============================| # |==== BUY CLIPPER + STEALER ====| # |=== http://teleg.run/QulabZ ===| # \===============================/ Date: 25.06.2022, 06:25:35 Main Information: - OS: Windows 7 X64 / Build: 7601 - UserName: Admin - ComputerName: TBHNEBSE - Processor: Intel Core Processor (Broadwell) - VideoCard: Standard VGA Graphics Adapter - Memory: 2.00 Gb - KeyBoard Layout ID: 00000409 - Resolution: 1280x720x32, 1 GHz Other Information: <error> Soft / Windows Components / Windows Updates: - Adobe AIR - Google Chrome - Microsoft Office Professional Plus 2010 - Adobe AIR - Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 - Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.30.30704 - Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.30.30704 - Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.40660 - Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.40660 - Microsoft Office Professional Plus 2010 - Microsoft Office Access MUI (English) 2010 - Microsoft Office Excel MUI (English) 2010 - Microsoft Office PowerPoint MUI (English) 2010 - Microsoft Office Publisher MUI (English) 2010 - Microsoft Office Outlook MUI (English) 2010 - Microsoft Office Word MUI (English) 2010 - Microsoft Office Proof (English) 2010 - Microsoft Office Proof (French) 2010 - Microsoft Office Proof (Spanish) 2010 - Microsoft Office Proofing (English) 2010 - Microsoft Office InfoPath MUI (English) 2010 - Microsoft Office Shared MUI (English) 2010 - Microsoft Office OneNote MUI (English) 2010 - Microsoft Office Groove MUI (English) 2010 - Microsoft Office Shared Setup Metadata MUI (English) 2010 - Microsoft Office Access Setup Metadata MUI (English) 2010 - Update for Microsoft .NET Framework 4.7.2 (KB4087364) - Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 - Adobe Reader 9 - Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 - Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 - Microsoft Visual C++ 2022 X86 Additional Runtime - 14.30.30704 - Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 - Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.40660 - Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.40660 - Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 - Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.30.30704 Process List: - [System Process] / PID: 0 - System / PID: 4 - smss.exe / PID: 260 - csrss.exe / PID: 332 - wininit.exe / PID: 368 - csrss.exe / PID: 380 - winlogon.exe / PID: 416 - services.exe / PID: 460 - lsass.exe / PID: 480 - lsm.exe / PID: 488 - svchost.exe / PID: 600 - svchost.exe / PID: 680 - svchost.exe / PID: 772 - svchost.exe / PID: 816 - svchost.exe / PID: 852 - svchost.exe / PID: 888 - svchost.exe / PID: 336 - spoolsv.exe / PID: 1028 - svchost.exe / PID: 1084 - taskhost.exe / PID: 1104 - dwm.exe / PID: 1180 - explorer.exe / PID: 1212 - svchost.exe / PID: 1044 - sppsvc.exe / PID: 1608 - WMIADAP.exe / PID: 2044 - NAPHLPR.exe / PID: 1660
URLs

http://teleg.run/QulabZ

Signatures

  • Qulab Stealer & Clipper

    Infostealer and clipper created with AutoIt.

  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 1 IoCs
  • Sets file to hidden 1 TTPs 1 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 14 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 12 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c58178687435a7997d8de3fcd8a76c1a4447beaabb4977882e4bc39ea27cc5a3.exe
    "C:\Users\Admin\AppData\Local\Temp\c58178687435a7997d8de3fcd8a76c1a4447beaabb4977882e4bc39ea27cc5a3.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1596
    • C:\Users\Admin\AppData\Local\Temp\c58178687435a7997d8de3fcd8a76c1a4447beaabb4977882e4bc39ea27cc5a3.exe
      "C:\Users\Admin\AppData\Local\Temp\c58178687435a7997d8de3fcd8a76c1a4447beaabb4977882e4bc39ea27cc5a3.exe"
      2⤵
      • NTFS ADS
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:1556
      • C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-t..ty-client.resources\NAPHLPR.exe
        C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-t..ty-client.resources\NAPHLPR.exe
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:1260
        • C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-t..ty-client.resources\NAPHLPR.exe
          "C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-t..ty-client.resources\NAPHLPR.exe"
          4⤵
          • Loads dropped DLL
          • NTFS ADS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1660
          • C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-t..ty-client.resources\NAPHLPR.module.exe
            C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-t..ty-client.resources\NAPHLPR.module.exe a -y -mx9 -ssw "C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-t..ty-client.resources\ENU_687FE975325E824E9D41.7z" "C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-t..ty-client.resources\1\*"
            5⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:1920
          • C:\Windows\SysWOW64\attrib.exe
            attrib +s +h "C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-t..ty-client.resources"
            5⤵
            • Sets file to hidden
            • Views/modifies file attributes
            PID:876
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {693C149F-AFA5-47F5-B336-7FC08E789F6B} S-1-5-21-1819626980-2277161760-1023733287-1000:TBHNEBSE\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1836
    • C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-t..ty-client.resources\NAPHLPR.exe
      C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-t..ty-client.resources\NAPHLPR.exe
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1004
      • C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-t..ty-client.resources\NAPHLPR.exe
        "C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-t..ty-client.resources\NAPHLPR.exe"
        3⤵
        • Drops file in System32 directory
        PID:1420
    • C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-t..ty-client.resources\NAPHLPR.exe
      C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-t..ty-client.resources\NAPHLPR.exe
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1368
      • C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-t..ty-client.resources\NAPHLPR.exe
        "C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-t..ty-client.resources\NAPHLPR.exe"
        3⤵
        • Drops file in System32 directory
        PID:676

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-t..ty-client.resources\1\Information.txt

    Filesize

    3KB

    MD5

    3db71bacd6dcfccc7e390b9d8d3f3af8

    SHA1

    10f12deb7a4f2bf3f0106c18e9592c74cdde21f6

    SHA256

    cf73d85afe7487fa84c636f7a6be38c0521ce7156f6c32868238a06dbf4c252a

    SHA512

    04c49ee1b117c54ff2f77edb88a4525d7f91445abf9c407e8e048054ccf5d1b3c76803b41ff88743709c70f58fb863a81bb2907a8327f4b366bd01b4ee7d74bf

  • C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-t..ty-client.resources\1\Screen.jpg

    Filesize

    45KB

    MD5

    6a65021d5394f88d6edc53e21c022db6

    SHA1

    3e4ec0a97d669bead1220f31ae486638de55ce51

    SHA256

    989f413d553993734a8a74a0b31a946f1a0d7b2ff042d0c2447d242f778b10cf

    SHA512

    818071114bbb55eda18c68926e5940deb24297983dee5847abb431e6dc62125e086c83f65067dae643245d30ccf2a9a39d56085285ca6e45bdaf01ca4b6a0c5d

  • C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-t..ty-client.resources\NAPHLPR.module.exe

    Filesize

    197KB

    MD5

    946285055913d457fda78a4484266e96

    SHA1

    668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285

    SHA256

    23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb

    SHA512

    30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

  • \Users\Admin\AppData\Roaming\x86_microsoft-windows-t..ty-client.resources\NAPHLPR.module.exe

    Filesize

    197KB

    MD5

    946285055913d457fda78a4484266e96

    SHA1

    668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285

    SHA256

    23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb

    SHA512

    30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

  • \Users\Admin\AppData\Roaming\x86_microsoft-windows-t..ty-client.resources\NAPHLPR.module.exe

    Filesize

    197KB

    MD5

    946285055913d457fda78a4484266e96

    SHA1

    668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285

    SHA256

    23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb

    SHA512

    30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

  • \Users\Admin\AppData\Roaming\x86_microsoft-windows-t..ty-client.resources\NAPHLPR.sqlite3.module.dll

    Filesize

    360KB

    MD5

    8c127ce55bfbb55eb9a843c693c9f240

    SHA1

    75c462c935a7ff2c90030c684440d61d48bb1858

    SHA256

    4f93f3543139febb91e0c95dc9351008e9147a484732ee5962c7df64f6868028

    SHA512

    d3578bd7ef01f9e25983c24eb9bb33f25c37d650cc79b823c3ec19f196d4a00deb506c1e1f774f15e5664d5263b02570fec11b322022b90a0ff1b10943188a02

  • \Users\Admin\AppData\Roaming\x86_microsoft-windows-t..ty-client.resources\NAPHLPR.sqlite3.module.dll

    Filesize

    360KB

    MD5

    8c127ce55bfbb55eb9a843c693c9f240

    SHA1

    75c462c935a7ff2c90030c684440d61d48bb1858

    SHA256

    4f93f3543139febb91e0c95dc9351008e9147a484732ee5962c7df64f6868028

    SHA512

    d3578bd7ef01f9e25983c24eb9bb33f25c37d650cc79b823c3ec19f196d4a00deb506c1e1f774f15e5664d5263b02570fec11b322022b90a0ff1b10943188a02

  • memory/676-124-0x0000000000670000-0x0000000000845000-memory.dmp

    Filesize

    1.8MB

  • memory/676-115-0x0000000000670000-0x0000000000845000-memory.dmp

    Filesize

    1.8MB

  • memory/1420-110-0x0000000000270000-0x0000000000445000-memory.dmp

    Filesize

    1.8MB

  • memory/1420-101-0x0000000000270000-0x0000000000445000-memory.dmp

    Filesize

    1.8MB

  • memory/1556-66-0x0000000000710000-0x00000000008E5000-memory.dmp

    Filesize

    1.8MB

  • memory/1556-57-0x0000000000710000-0x00000000008E5000-memory.dmp

    Filesize

    1.8MB

  • memory/1556-55-0x0000000000710000-0x00000000008E5000-memory.dmp

    Filesize

    1.8MB

  • memory/1596-54-0x0000000076181000-0x0000000076183000-memory.dmp

    Filesize

    8KB

  • memory/1660-80-0x0000000000730000-0x0000000000905000-memory.dmp

    Filesize

    1.8MB

  • memory/1660-95-0x0000000061E00000-0x0000000061ED2000-memory.dmp

    Filesize

    840KB

  • memory/1660-96-0x00000000044B0000-0x000000000452D000-memory.dmp

    Filesize

    500KB

  • memory/1660-94-0x0000000061E00000-0x0000000061ED2000-memory.dmp

    Filesize

    840KB

  • memory/1660-92-0x00000000044B0000-0x000000000452D000-memory.dmp

    Filesize

    500KB

  • memory/1660-93-0x00000000044B0000-0x000000000452D000-memory.dmp

    Filesize

    500KB

  • memory/1660-83-0x0000000061E00000-0x0000000061ED2000-memory.dmp

    Filesize

    840KB

  • memory/1660-71-0x0000000000730000-0x0000000000905000-memory.dmp

    Filesize

    1.8MB

  • memory/1920-90-0x0000000000400000-0x000000000047D000-memory.dmp

    Filesize

    500KB